Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature

published 2022-06-06 4 y ago modified 2026-08-07 3 mo ago also EUVD-2022-6001 , GHSA-9394-xfq9-6qrp

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits: 0; none known

Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.

Patch / fix

fixed in 4

go github.com/projectcalico/calico 3.20.5, 3.21.5, 3.22.2
tigera calico_enterprise 3.11.4, 3.12.1
projectcalico calico 3.20.5, 3.21.5, 3.22.2
tigera calico_os 3.20.5, 3.21.5, 3.22.2

Exploit prediction

0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
GitHub	3.1	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
NVD	3.1	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
NVD	2.0	5.5	AV:N/AC:L/Au:S/C:N/I:P/A:P

Affected packages

ecosystem	package	affected	fixed in
go	github.com/projectcalico/calico	>=3.22.0, <3.22.2 >=3.21.0, <3.21.5 <3.20.5	3.22.2 3.21.5 3.20.5

Affected products

Tigera Calico Enterprise
Project Calico Calico

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-201 Insertion of Sensitive Information Into Sent Data
CWE-20 Improper Input Validation

References

tigera.io /security-bulletins-tta-2022-001/
vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2022-28224
advisory
github.com /projectcalico/calico
package
tigera.io /security-bulletins-tta-2022-001
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Correcting CPE configurations for the Calico open source product to be application type rather than os. It seems the NVD folks got confused by the name calico_os and though it was an operating system.

Summary